Hello, all
It seems to me that you're talking about inbound Passive FTP problems, initial connection made, but cannot list directories; it also seems to me that the internal FTP server is responding on the PORT command with its public IP, instead of with the private one. Check on the server settings... Or get some 'captures' from both the inside and outside interfaces, that would help you determine the causes for that. Assuming that you have something like this:
static (inside,outside) ftp-global-ip ftp-local-ip
OK, so here is an example how to get the captures:
access-list ftp-out permit tcp any host ftp-global-ip
access-list ftp-out permit tcp host ftp-global-ip any
access-list ftp-in permit tcp any host ftp-local-ip
access-list ftp-in permit tcp host ftp-local-ip any
capture capout access-list ftp-out interface outside packet-length 1500
capture capin access-list ftp-in interface inside packet-length 1500
Then try to make the inbound connection to the FTP server. To download the capture from the PIX:
http server enable
http ip-address-host-downloading-capture 255.255.255.255 inside
And go to:
https://inside-interface-ip/capture/capin/Pcap
https://inside-interface-ip/capture/capout/Pcap
Make sure that you save the file with a libcap format (*.cap) so you can open it with any protocol analyzer program, like Ethereal. Must likely you will find the server responding on the port command with its public IP. You will see something like:
PORT (a,b,c,d,FF,FF); where a.b.c.d is the IP address [should be the private one] and FF,FF is used to determine the port number to use for the data channel...
Hope that helps!
Federico Rodriguez
